Skip to main content

AI Triage

A scanner can flag code that looks dangerous but isn't, in context. AI Triage reads the flagged code and the code around it, works out who could actually exploit the finding and what they would gain, and sets the severity the finding deserves.

What AI Triage assesses​

AI Triage answers the questions a security lead would ask, and shows the answers on the issue's scorecard:

  • Context - what the flagged code is part of, who uses it, and where it runs.
  • Attack path - the route from where input enters the application to the flagged code, including every authentication, permission, or validation check it passes.
  • Reachability - the least-privileged person who can trigger it: anyone, any signed-in user, a privileged user, internal staff only, or no one (it happens in normal operation).
  • Adversary and preconditions - who would exploit it, and the access they already hold.
  • Impact - what this weakness lets them do beyond that existing access, and what it would cost you.
  • Likelihood - whether a real attacker would want the outcome, and how hard the attack is.
  • Mitigations - controls on this exact path that block or limit the attack, with their location in the code.
  • Recommended severity - the severity the finding deserves, and the fact that decided it.

Where a fact can't be established from the code, such as network exposure or whether data is regulated, AI Triage says it is an assumption rather than presenting it as confirmed.

Auto-dismissed findings​

When AI Triage dismisses a finding, its reasoning is recorded as the dismissal note, so you can see exactly why. Dismissed findings are marked in the Issues view. Other actionable sub-issues remain open.

If you disagree with an auto-dismissal, restore it the same way you restore any other dismissed sub-issue. See Triaging Sub-issues.

Learning from your dismissal notes​

When you dismiss a finding with a reason and note, Dam Secure can turn that into lasting security context for the repository. Later AI Triage runs use that context alongside what they learn from the code.

This is especially valuable for controls that live outside the repository (for example, "rate limiting is enforced at the load balancer"), which Dam Secure cannot observe directly in the codebase.